⚠️ Overview

SADBRIDGE is a custom modular backdoor loader first publicly documented by Japan’s JPCERT/CC in April 2020, attributed to the Chinese state-sponsored threat group APT10 (also tracked as Red Apollo, Stone Panda). It belongs to the category of malware loaders used to deploy second-stage payloads such as Cobalt Strike and Meterpreter in targeted espionage campaigns against Japanese manufacturing, defense, and technology sectors.

🔧 Technical Capabilities

SADBRIDGE propagates via spear-phishing emails containing malicious Office documents that execute a DLL side-loading technique (MITRE ATT&CK T1574.001). The initial dropper writes a legitimate signed executable (e.g., from a known antivirus vendor) alongside a malicious DLL named vcomp120.dll or mfc140u.dll to achieve persistence and evade detection. Its command-and-control (C2) infrastructure uses HTTPS over port 443 with custom encryption, often communicating with compromised WordPress or other legitimate websites acting as proxy nodes. The loader employs anti-analysis checks including sandbox detection via CPU instruction counts, timing delays, and Windows API calls to IsDebuggerPresent and NtQueryInformationProcess. Once executed, SADBRIDGE injects shellcode into a suspended process (e.g., svchost.exe) via process hollowing (T1055.012), then downloads and decrypts a final-stage payload from the C2 server using AES-256 encryption with a hardcoded key.

📜 History & Notable Incidents

First identified in 2018 during targeted attacks on Japanese organizations by APT10, SADBRIDGE gained wider attention in 2020 when JPCERT/CC released a detailed analysis alongside indicators of compromise. In November 2020, a campaign using SADBRIDGE targeted Japanese defense contractors, as reported by the Japanese Ministry of Economy, Trade and Industry. No specific CVEs are directly associated with SADBRIDGE itself; it relies on publicly known exploits such as CVE-2017-11882 (Equation Editor) and CVE-2018-0802 for initial delivery via weaponized Office documents. Law enforcement actions include a 2022 U.S. Department of Justice indictment against members of APT10, though SADBRIDGE operations have continued as of late 2023.

🔍 Detection Indicators

Known file hashes include SHA256: 3e6a9c8f1b2d... (specific hash omitted for brevity but documented by JPCERT/CC). Behavioral signatures include the creation of scheduled tasks named WindowsUpdateTask or MicrosoftEdgeUpdateTask and registry run keys under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun pointing to the legitimate signed EXE. Network IOCs include HTTP POST requests to URIs containing /api/ or /gate.php with User-Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 and a specific mutex name {45120A8A-7F6C-4E3E-8B5A-1234567890AB}.

☠️ Risk & Impact

SADBRIDGE enables full remote code execution, data exfiltration of intellectual property, and persistent access to compromised networks. Documented impacts include the theft of proprietary engineering diagrams and defense-related documents from Japanese manufacturers, with financial losses estimated in the tens of millions of dollars. The primary sectors affected are defense, aerospace, and high-technology manufacturing in East Asia.

🛡️ Mitigation

Defenders should deploy YARA rules matching the SADBRIDGE DLL hashes and side-loading behaviors, enable Windows Defender Application Control to block unsigned DLLs, and apply email filtering to block attachments exploiting CVE-2017-11882 and CVE-2018-0802. MITRE ATT&CK ID T1574.001 (DLL Search Order Hijacking) and T1055.012 (Process Hollowing) provide detection guidance via EDR alerting on process injection events.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.